76e876aafac2ca23f4e0fd2e4f64052ab4d4235ccc9f8162c298e566e34101a8

Resubmissions

27/04/2024, 14:10

240427-rg3c3scf2v 3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 14:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

discord-mass-dm-main/data/message.json
Size

145B
MD5

6684dd15d0cd2b513b447506390c0126
SHA1

127eef69d950c48c602adca4eab9b9480f53e20c
SHA256

0b1686c1a1f9d1b8fe52a07ae76042200b9e4e16064d29958a90b86e7eb687ef
SHA512

d89afc51f3ee489bd0f891760387c53f3157379d6ae4a941bdadab3b788ec04179e66dd2444f607bd14b0f60342103fe3c27f21a2c3389534577951ecd8c0acd

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2032	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2032	AcroRd32.exe
2032	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2676	2292	cmd.exe	29
PID 2292 wrote to memory of 2676	2292	cmd.exe	29
PID 2292 wrote to memory of 2676	2292	cmd.exe	29
PID 2676 wrote to memory of 2032	2676	rundll32.exe	30
PID 2676 wrote to memory of 2032	2676	rundll32.exe	30
PID 2676 wrote to memory of 2032	2676	rundll32.exe	30
PID 2676 wrote to memory of 2032	2676	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\discord-mass-dm-main\data\message.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\discord-mass-dm-main\data\message.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\discord-mass-dm-main\data\message.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7888a4d5e909818eac08b82dd99f81cb

SHA1
bd56784ac401375e697292dae61f532e84d24007

SHA256
1d7aa811a28699f5db1e3566bfa8b7971fc35399f1812e22aa8aa96b191e7c52

SHA512
c8e14ae3e4e5ddadaef6beed6800328ceb6c58564969ac4a3dc751060e41114e5887b3c401cb01292e1dcf361f6dd81026c69a8dca7b9414ce528bf32e842a0c

Download Submit